Networking basics and ports

Addresses and routes

ip addr displays interfaces and addresses; ip route displays paths. An address such as 192.0.2.10/24 carries a prefix length: /24 means the first 24 bits identify the network, so hosts 192.0.2.1 to 192.0.2.254 share it. Private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) are used inside companies and cloud VPCs and are not reachable from the internet directly. The default via line in ip route is the gateway that receives traffic for every other network.

flowchart LR
  A["ip addr, ip route<br/>my address and route"] --> N["getent hosts<br/>name to IP"]
  N --> P["ping, traceroute<br/>can I reach it?"]
  P --> S["nc -vz host 443<br/>is the port open?"]
  S --> L["ss -tlnp<br/>who listens here?"]
  L --> H["curl -v<br/>does the app answer?"]
  %% step A: Start local: does the machine have an address and a default route?
  %% step N: Check that the name resolves to the IP you expect.
  %% step P: Test reachability; ICMP may be blocked even when the service works.
  %% step S: Test the TCP port itself, which is what the application needs.
  %% step L: On the server, ss shows which process listens on which port.
  %% step H: Finally test the application layer: HTTP status, TLS and headers.

Names

DNS turns a name into an address. Linux reads its resolver settings from /etc/resolv.conf and checks /etc/hosts for local overrides first. getent hosts example.com follows the same order as applications, while dig example.com or nslookup query DNS directly and show the answering server.

Reachability and ports

ping tests ICMP reachability, but success does not prove an application's TCP port is open, and failure may only mean ICMP is blocked. tracepath or traceroute shows the hops along the way. nc -zv db.example.com 5432 checks whether a single TCP port accepts connections.

ss -lntp lists listening TCP sockets numerically and shows processes when permissions allow. A service listening on 127.0.0.1 accepts only local connections; 0.0.0.0 means every interface.

Application layer

curl http://localhost tests HTTP at the application layer; curl -I prints only the response headers, and curl -v shows the TLS handshake and request. ssh user@host opens a remote shell, and scp file user@host:/tmp/ copies a file over the same connection.

Firewalls

Even with a listening socket, a host firewall can drop traffic. Ubuntu commonly uses ufw (sudo ufw status), while the Red Hat family uses firewalld (sudo firewall-cmd --list-all). In the cloud, security groups add another filter outside the machine.

ifconfig and netstat are older tools and may not be installed; ip and ss are the modern choices. Debug layer by layer: name resolution, route, host reachability, listening socket, firewall, then application response.